Based on my experience:

A.- I would also add "nofollow, noarchive" tags [1] to your X-Robots-Tag header:

- "nofollow" -> do not to follow (i.e., crawl) any outgoing links on the page.

- "noarchive" -> prevents Google from showing the Cached link for a page.

B.- I would specify in Search Console (former Webmaster Console) how should Google handle "query" parameter [2]

C.- Prevent those spam searches by blocking source IP address, User-Agents, combinations of both, etc.

Good luck!

[1] https://support.google.com/webmasters/answer/79812?hl=en

[2] https://www.google.com/webmasters/tools/crawl-url-parameters...